<html>
<head><meta charset="utf-8"><title>Does UnsafeCell&lt;T&gt; leak mutability · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html">Does UnsafeCell&lt;T&gt; leak mutability</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="214139411"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214139411" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214139411">(Oct 22 2020 at 03:06)</a>:</h4>
<p>I was wondering for a while about UnsafeCell, and how it interacts with aliasing rules. In particular it's valid to mutate a T inside a shared reference to an UnsafeCell&lt;T&gt;. I was wondering if this "leaks" outwards to the UnsafeCell.<br>
This applies to some optimizations in lccc (a compiler I'm working on). Essentially, in lccc, an UnsafeCell is represented as a struct with a mutable member (with C's mutability semantics, plus some attribute propagation suppression). However, I wouldn't like suppress the readonly attribute on &amp;UnsafeCell&lt;T&gt;. Is it valid to assume, in rust, that if a mutable pointer to an UnsafeCell (or a generic type/type dependent on a generic parameter, which may be or contain an UnsafeCell) is written to, that it cannot alias a shared reference of the same type (IE. is the interior mutability of UnsafeCell perfectly interior).</p>



<a name="214140874"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214140874" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214140874">(Oct 22 2020 at 03:47)</a>:</h4>
<p>See the internal <code>Freeze</code> auto-trait, which <code>UnsafeCell</code> does not implement.</p>



<a name="214140946"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214140946" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214140946">(Oct 22 2020 at 03:49)</a>:</h4>
<p>Note that <code>&amp;mut UnsafeCell&lt;_&gt;</code> still has all the same <code>&amp;mut</code> rules -- you can't have one of those while also having any <code>&amp;UnsafeCell&lt;_&gt;</code>s.</p>



<a name="214140950"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214140950" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214140950">(Oct 22 2020 at 03:49)</a>:</h4>
<p>Frozen <code>&amp;</code> references are marked <code>noalias</code> for LLVM, even though they can alias, because they're never data races</p>



<a name="214152704"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214152704" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214152704">(Oct 22 2020 at 07:37)</a>:</h4>
<p><span class="user-mention silent" data-user-id="125270">scottmcm</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability/near/214140946">said</a>:</p>
<blockquote>
<p>Note that <code>&amp;mut UnsafeCell&lt;_&gt;</code> still has all the same <code>&amp;mut</code> rules -- you can't have one of those while also having any <code>&amp;UnsafeCell&lt;_&gt;</code>s.</p>
</blockquote>
<p>Does that mean that <code>get_mut(&amp;mut UnsafeCell&lt;T&gt;) -&gt; &amp;mut T</code> could be a safe function?</p>



<a name="214171769"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214171769" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Diggsey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214171769">(Oct 22 2020 at 11:09)</a>:</h4>
<p>No, I think there could still be "aliasing" references to the inside of the <code>UnsafeCell&lt;T&gt;</code> just not the <code>UnsafeCell</code> itself.</p>



<a name="214177323"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214177323" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214177323">(Oct 22 2020 at 12:11)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability/near/214152704">said</a>:</p>
<blockquote>
<p>Does that mean that <code>get_mut(&amp;mut UnsafeCell&lt;T&gt;) -&gt; &amp;mut T</code> could be a safe function?</p>
</blockquote>
<p><a href="https://doc.rust-lang.org/nightly/std/cell/struct.UnsafeCell.html#method.get_mut">https://doc.rust-lang.org/nightly/std/cell/struct.UnsafeCell.html#method.get_mut</a></p>



<a name="214177661"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214177661" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214177661">(Oct 22 2020 at 12:14)</a>:</h4>
<p><span class="user-mention silent" data-user-id="295632">Diggory Blake</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability/near/214171769">said</a>:</p>
<blockquote>
<p>No, I think there could still be "aliasing" references to the inside of the <code>UnsafeCell&lt;T&gt;</code> just not the <code>UnsafeCell</code> itself.</p>
</blockquote>
<p>Well, you can still use <code>mem::swap::&lt;UnsafeCell&lt;_&gt;&gt;</code> and things like <code>*x = UnsafeCell::new(...);</code> to perform <code>noalias</code> mutations, so <code>.get_mut()</code> is a given.</p>



<a name="214203593"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214203593" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214203593">(Oct 22 2020 at 15:28)</a>:</h4>
<blockquote>
<p>See the internal <code>Freeze</code> auto-trait, which <code>UnsafeCell</code> does not implement.</p>
</blockquote>
<p>Yes, I am aware of the rustc implementation. My question is if a different implementation which does emit readonly (at the ir level, not the llvm level), and preforms TBAA to determine whether accesses can interfere is correct (Which allows me to do readonly alias checking in a dependant context)? Is there anything in rust and/or SB that says whether or not <code>UnsafeCell&lt;T&gt;</code> allows you to mutate the UnsafeCell itself (and not the inner field) via a pointer derived from a <code>&amp;UnsafeCell</code>?</p>



<a name="214203747"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214203747" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214203747">(Oct 22 2020 at 15:29)</a>:</h4>
<blockquote>
<p>mutate the UnsafeCell itself (and not the inner field)</p>
</blockquote>
<p>what does this mean?</p>



<a name="214203902"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214203902" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214203902">(Oct 22 2020 at 15:30)</a>:</h4>
<p>I think it is pretty rare to actually have a <code>&amp;mut UnsafeCell&lt;T&gt;</code>, because it's equivalent to a <code>&amp;mut T</code> as discussed</p>



<a name="214204400"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214204400" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214204400">(Oct 22 2020 at 15:33)</a>:</h4>
<p>I think the existence of <code>UnsafeCell::get_mut</code> implies that this is UB:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">cell</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">UnsafeCell</span>::<span class="n">new</span><span class="p">(</span><span class="mi">0</span><span class="p">);</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">r</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">cell</span><span class="p">.</span><span class="n">get</span><span class="p">();</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">mutr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">cell</span><span class="p">.</span><span class="n">get_mut</span><span class="p">();</span><span class="w"></span>
<span class="o">*</span><span class="n">r</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">1</span><span class="p">;</span><span class="w"></span>
<span class="k">use</span><span class="p">(</span><span class="n">mutr</span><span class="p">);</span><span class="w"></span>
</code></pre></div>



<a name="214204403"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214204403" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214204403">(Oct 22 2020 at 15:33)</a>:</h4>
<p>(In lccc's model, which is derived mostly from C and C++) Conceptually in let x = UnsafeCell::new(5);, there are two distinct objects: x itself, and x.inner, even though they are perfectly overlapping in memory. x has type UnsafeCell&lt;i32&gt; and x.inner has type i32. I want to maintain this logical distinction, even when it is not a physical one (using <em>pointer-interconvertibility</em> rules)</p>



<a name="214204553"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214204553" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214204553">(Oct 22 2020 at 15:34)</a>:</h4>
<p>Would that extend to ptr::write as well?</p>



<a name="214204610"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214204610" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214204610">(Oct 22 2020 at 15:35)</a>:</h4>
<p>the write to <code>r</code> is <code>ptr::write</code></p>



<a name="214204693"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214204693" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214204693">(Oct 22 2020 at 15:35)</a>:</h4>
<p>Isn't it technically a reborrow-dereference (since it drops)</p>



<a name="214204775"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214204775" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214204775">(Oct 22 2020 at 15:36)</a>:</h4>
<p>what drops?</p>



<a name="214204813"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214204813" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214204813">(Oct 22 2020 at 15:36)</a>:</h4>
<p>in SB, <code>mutr</code> is invalidated at the write to <code>r</code>, so the use is UB</p>



<a name="214204919"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214204919" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214204919">(Oct 22 2020 at 15:37)</a>:</h4>
<p><code>r</code> is a raw pointer, but it still logically has a lifetime associated to it even though rust can't track it</p>



<a name="214204975"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214204975" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214204975">(Oct 22 2020 at 15:38)</a>:</h4>
<p>if it could, it would see that <code>r</code> and <code>mutr</code> are live simultaneously so it wouldn't compile</p>



<a name="214205184"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214205184" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214205184">(Oct 22 2020 at 15:39)</a>:</h4>
<p><span class="user-mention silent" data-user-id="257758">Connor Horman</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability/near/214204693">said</a>:</p>
<blockquote>
<p>Isn't it technically a reborrow-dereference (since it drops)</p>
</blockquote>
<p>Oh I see now what you mean, the original value in the unsafe cell (the <code>0</code>) is dropped with <code>*r = 1</code></p>



<a name="214205391"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214205391" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214205391">(Oct 22 2020 at 15:40)</a>:</h4>
<p>but both <code>ptr::write(r, 1)</code> and <code>*r = 1</code> have the same effect on the memory insofar as they both write via raw pointer, invalidating the existing <code>Uniq</code> tag</p>



<a name="214205766"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214205766" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214205766">(Oct 22 2020 at 15:43)</a>:</h4>
<p>So an example where you mutate the cell directly would be:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">cell</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">UnsafeCell</span>::<span class="n">new</span><span class="p">(</span><span class="mi">0</span><span class="p">);</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">r</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">cell</span><span class="p">.</span><span class="n">get</span><span class="p">();</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">mutr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">cell</span><span class="p">;</span><span class="w"></span>
<span class="o">*</span><span class="n">r</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">1</span><span class="p">;</span><span class="w"></span>
<span class="k">use</span><span class="p">(</span><span class="n">mutr</span><span class="p">);</span><span class="w"></span>
</code></pre></div>

<p>and this would also be UB</p>



<a name="214205974"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214205974" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214205974">(Oct 22 2020 at 15:44)</a>:</h4>
<p>But regarding TBAA, I don't know if there is anything nontrivial you can say about rust code satisfying TBAA like restrictions</p>



<a name="214205990"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214205990" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214205990">(Oct 22 2020 at 15:45)</a>:</h4>
<p>Rust doesn't allow TBAA. For example <code>std::mem::transmute::&lt;&amp;u32, &amp;[u8; 4]&gt;(p)</code> is allowed and used in libstd.</p>



<a name="214206085"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214206085" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214206085">(Oct 22 2020 at 15:45)</a>:</h4>
<p><code>u32::as_ne_bytes</code> is effectively that, though it uses a pointer cast.</p>



<a name="214206086"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214206086" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214206086">(Oct 22 2020 at 15:45)</a>:</h4>
<p><span class="user-mention" data-user-id="133247">@bjorn3</span> What are the restrictions on the lifetimes in that transmute?</p>



<a name="214206269"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214206269" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214206269">(Oct 22 2020 at 15:46)</a>:</h4>
<p>The lifetime has to be smaller or equal for the output like normal.</p>



<a name="214206324"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214206324" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214206324">(Oct 22 2020 at 15:47)</a>:</h4>
<p>I wonder how that works out in more complex situations</p>



<a name="214206349"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214206349" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214206349">(Oct 22 2020 at 15:47)</a>:</h4>
<p>has safe-transmute WG tried to address this?</p>



<a name="214206609"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214206609" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214206609">(Oct 22 2020 at 15:49)</a>:</h4>
<p>I assume the safe-transmute WG doesn't concern itself with types containing references. Only POD's.</p>



<a name="214206702"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214206702" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214206702">(Oct 22 2020 at 15:49)</a>:</h4>
<p>Is it possible to do TBAA if you don't have any such transmutes in the code? SB might be able to supply the aliasing restrictions on references from "foreign" code and TBAA can carry the rest under limited conditions</p>



<a name="214206824"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214206824" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214206824">(Oct 22 2020 at 15:50)</a>:</h4>
<blockquote>
<p>Rust doesn't allow TBAA. For example <code>std::mem::transmute::&lt;&amp;u32, &amp;[u8; 4]&gt;(p)</code> is allowed and used in libstd.</p>
</blockquote>
<p>Not strict-aliasing. TBAA where I use the fact two pointers are the same type, but with incompatible attributes, to show they don' alias.</p>



<a name="214206846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214206846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214206846">(Oct 22 2020 at 15:50)</a>:</h4>
<p>Lifetimes are not a validity invariant (atm). They are a very important safety invariant though.<br>
It's not invalid to transmute a ref to <code>&amp;'static _</code> but you can't use it with that lifetime</p>



<a name="214206951"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214206951" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214206951">(Oct 22 2020 at 15:51)</a>:</h4>
<p>Is there a reason why you are allowed to? I would also prefer to assume you can't widen a bound (how lifetimes are represented) ever.</p>



<a name="214206966"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214206966" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214206966">(Oct 22 2020 at 15:51)</a>:</h4>
<p>well you don't have lifetimes per se but you do have SB which is almost the same</p>



<a name="214207102"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207102" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207102">(Oct 22 2020 at 15:52)</a>:</h4>
<p>No, SB is an execution model. Lifetimes are a type model that only permit a subset of executions of SB.</p>



<a name="214207119"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207119" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207119">(Oct 22 2020 at 15:52)</a>:</h4>
<p>As far as I know strict-aliasing is when you use <code>restrict</code> to say that two pointer arguments don't alias. TBAA is saying that two pointers don't alias when their types are different.</p>



<a name="214207258"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207258" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207258">(Oct 22 2020 at 15:54)</a>:</h4>
<p>Lifetimes are pretty much static approximation of the things allowed by SB.</p>



<a name="214207347"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207347" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207347">(Oct 22 2020 at 15:54)</a>:</h4>
<p>strict-aliasing is you can't access an object of type T through an lvalue of an unrelated type.</p>



<a name="214207377"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207377" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207377">(Oct 22 2020 at 15:54)</a>:</h4>
<p>that's definitely not true for rust</p>



<a name="214207394"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207394" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207394">(Oct 22 2020 at 15:54)</a>:</h4>
<p>TBAA is a wide set of optimizations based on the types of pointers, and includes strict-aliasing.</p>



<a name="214207443"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207443" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207443">(Oct 22 2020 at 15:55)</a>:</h4>
<p>what optimizations are you talking about specifically then?</p>



<a name="214207495"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207495" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207495">(Oct 22 2020 at 15:55)</a>:</h4>
<p>You could conclude that two types that have no overlap of valid representations can not alias as references.</p>



<a name="214207514"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207514" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207514">(Oct 22 2020 at 15:55)</a>:</h4>
<p>in rust the type of a pointer is almost completely irrelevant</p>



<a name="214207605"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207605" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207605">(Oct 22 2020 at 15:56)</a>:</h4>
<p>what matters are the aliasing restrictions coming from SB</p>



<a name="214207636"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207636" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207636">(Oct 22 2020 at 15:56)</a>:</h4>
<p>E.g. <code>enum A { Foo = 0 } \n enum B { Foo = 1 }</code> then <code>(a: &amp;A) != &amp;(b: B)</code> must hold</p>



<a name="214207684"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207684" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207684">(Oct 22 2020 at 15:56)</a>:</h4>
<p>but <code>(a: *const A) != (b: *const B)</code> doesn't</p>



<a name="214207696"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207696" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207696">(Oct 22 2020 at 15:57)</a>:</h4>
<p>In rust it is allowed to have <code>&amp;2 as *const bool</code>. A bool can't ever be 2, but a <code>*const bool</code> is allowed to point to the value 2.</p>



<a name="214207726"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207726" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207726">(Oct 22 2020 at 15:57)</a>:</h4>
<p>Yes, that wouldn't need to hold. But you can safely create any pointer value of a sized type</p>



<a name="214207779"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207779" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207779">(Oct 22 2020 at 15:57)</a>:</h4>
<blockquote>
<p>E.g. <code>enum A { Foo = 0 } \n enum B { Foo = 1 }</code> then <code>(a: &amp;A) != &amp;(b: B)</code> must hold<br>
We don't know that references need to refer to valid values yet.</p>
</blockquote>



<a name="214207892"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207892" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207892">(Oct 22 2020 at 15:58)</a>:</h4>
<p>Also under Ralf's proposal of validity not depending on memory, I don't think <code>(a: &amp;A) != &amp;(b: B)</code> must hold</p>



<a name="214207947"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214207947" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214207947">(Oct 22 2020 at 15:58)</a>:</h4>
<p>Count it to the pile of arguments for _not_ deciding on this yet.</p>



<a name="214209566"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214209566" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214209566">(Oct 22 2020 at 16:10)</a>:</h4>
<p>Also, I'm not asserting that <code>*mut T </code> doesn't alias a <code>*mut T</code>, rather I'm asserting a written to <code>*mut T</code> does not alias subsequently used <code>&amp;T</code>, even when T has an interior mutable field, or is a generic type that may have an interior mutable field.</p>



<a name="214210329"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214210329" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214210329">(Oct 22 2020 at 16:15)</a>:</h4>
<p>And seeing the above, I assume this is a valid transformation.</p>



<a name="214210414"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214210414" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214210414">(Oct 22 2020 at 16:15)</a>:</h4>
<p>I don't think SB prevents the following from being well defined:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="kd">let</span><span class="w"> </span><span class="n">cell</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">UnsafeCell</span>::<span class="n">new</span><span class="p">(</span><span class="mi">0</span><span class="k">u8</span><span class="p">);</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">r</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">cell</span><span class="p">.</span><span class="n">get</span><span class="p">()</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">UnsafeCell</span><span class="o">&lt;</span><span class="kt">u8</span><span class="o">&gt;</span><span class="p">;</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">r2</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="n">cell</span><span class="p">;</span><span class="w"></span>
<span class="n">ptr</span>::<span class="n">write</span><span class="p">(</span><span class="n">r</span><span class="p">,</span><span class="w"> </span><span class="n">UnsafeCell</span>::<span class="n">new</span><span class="p">(</span><span class="mi">1</span><span class="p">));</span><span class="w"></span>
<span class="k">use</span><span class="p">(</span><span class="n">r2</span><span class="p">);</span><span class="w"></span>
</code></pre></div>



<a name="214210562"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214210562" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214210562">(Oct 22 2020 at 16:16)</a>:</h4>
<p>because the write to <code>r</code> is indistinguishable from if we had not cast it and just used <code>ptr::write(r, 1)</code></p>



<a name="214210598"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214210598" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214210598">(Oct 22 2020 at 16:17)</a>:</h4>
<p>which is exactly what you don't want to hear, I think</p>



<a name="214210611"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214210611" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214210611">(Oct 22 2020 at 16:17)</a>:</h4>
<p>If I understand what you mean correctly the answer is: SB doesn't allow it at the moment, but it is possible to do this using safe code.</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">a</span>: <span class="kp">&amp;</span><span class="nc">RefCell</span><span class="o">&lt;</span><span class="kt">u32</span><span class="o">&gt;</span><span class="p">,</span><span class="w"> </span><span class="n">b</span>: <span class="nc">RefMut</span><span class="o">&lt;'</span><span class="nb">_</span><span class="p">,</span><span class="w"> </span><span class="kt">u32</span><span class="o">&gt;</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kt">u32</span> <span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="nb">drop</span><span class="p">(</span><span class="n">b</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="o">*</span><span class="n">a</span><span class="p">.</span><span class="n">borrow</span><span class="p">()</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>

<span class="kd">let</span><span class="w"> </span><span class="n">c</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">RefCell</span>::<span class="n">new</span><span class="p">(</span><span class="n">c</span><span class="p">);</span><span class="w"></span>
<span class="n">foo</span><span class="p">(</span><span class="o">&amp;</span><span class="n">c</span><span class="p">,</span><span class="w"> </span><span class="n">c</span><span class="p">.</span><span class="n">borrow_mut</span><span class="p">());</span><span class="w"></span>
</code></pre></div>



<a name="214211061"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214211061" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214211061">(Oct 22 2020 at 16:20)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability/near/214210562">said</a>:</p>
<blockquote>
<p>because the write to <code>r</code> is indistinguishable from if we had not cast it and just used <code>ptr::write(r, 1)</code></p>
</blockquote>
<p>That specific example doesn't work I think. <code>&amp;cell</code> pops the SharedReadWrite item pushed by <code>cell.get()</code> from the stack I think.</p>



<a name="214211101"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214211101" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214211101">(Oct 22 2020 at 16:20)</a>:</h4>
<p>no, because it's an unsafecell</p>



<a name="214211206"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214211206" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214211206">(Oct 22 2020 at 16:21)</a>:</h4>
<p><code>UnsafeCell</code> caused the the <code>.get()</code> to push SharedReadWrite instead of SharedReadOnly.</p>



<a name="214211385"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214211385" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214211385">(Oct 22 2020 at 16:22)</a>:</h4>
<p>yeah, but creating (or already having) an <code>&amp;UnsafeCell</code> should not invalidate the SharedReadWrite</p>



<a name="214211433"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214211433" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214211433">(Oct 22 2020 at 16:23)</a>:</h4>
<p>you could swap the <code>let r</code> and <code>let r2</code> lines in the example</p>



<a name="214211483"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214211483" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214211483">(Oct 22 2020 at 16:23)</a>:</h4>
<p>You're right. I can't get miri to complain.</p>



<a name="214215693"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214215693" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214215693">(Oct 22 2020 at 16:54)</a>:</h4>
<blockquote>
<p>which is exactly what you don't want to hear, I think</p>
</blockquote>
<p>Yeah, that's not exactly the most favourable answer. I'd rather avoid having pointer attributes be replaceable. In the case above, I actually treat that as a semantically different value (a most-derived subobject of an object of a <code>repr(transparent)</code> struct is <em>pointer-interconvertible</em> with that object, so the cast from <code>*mut T</code> to <code>*mut UnsafeCell&lt;T&gt;</code> actually produces an actual pointer to the UnsafeCell, not a reinterpreted pointer to the T. This is the primary justification for the optimization I want to do, because you are writing to a readonly object (an IR-level invalid operation). It's kind of annoying that I can't do this, because it actually extends to other optimizations (Ideally, most of my optimization passes are before generic declarations are instantiated, because it reduces time spent in those optimizations).</p>



<a name="214216763"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214216763" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214216763">(Oct 22 2020 at 17:02)</a>:</h4>
<p>In cg_llvm the <code>noalias</code> attribute is not emitted for references to types that are <code>!Freeze</code> (<code>tcx.is_freeze</code>) The <code>noalias</code> attribute is never emitted for pointers.</p>



<a name="214217510"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214217510" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214217510">(Oct 22 2020 at 17:08)</a>:</h4>
<p>I'm not asking about rustc, cg_llvm is out of scope for this question. I'm asking about rust proper, and the UCG understanding of it (especially since I intend to adopt UCG as correct in lccc, except where it violates some rule of rust or some narrowly-tailored guarantee lccc makes). If the answer is yes, I can do this optimization, brilliant. If not, I can probably work around it. Also, here attributes applied to a pointer value include inferred attributes.</p>



<a name="214219660"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214219660" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214219660">(Oct 22 2020 at 17:24)</a>:</h4>
<p>But basically, the answer is I can't have a &amp;mut UnsafeCell&lt;T&gt; and a &amp;UnsafeCell&lt;T&gt; at the same time, but it's valid to write to a *mut UnsafeCell&lt;T&gt; even if it came from a shared reference? I think I can live with that. It just slightly reduces the scope of attribute aliasing analysis in generic types that may contain an UnsafeCell (or really anything with a mutable tagged member).</p>



<a name="214340811"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214340811" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214340811">(Oct 23 2020 at 17:19)</a>:</h4>
<blockquote>
<p>Is it valid to assume, in rust, that if a mutable pointer to an UnsafeCell (or a generic type/type dependent on a generic parameter, which may be or contain an UnsafeCell) is written to, that it cannot alias a shared reference of the same type (IE. is the interior mutability of UnsafeCell perfectly interior).</p>
</blockquote>
<p>If the writing pointer is a mutable <em>reference</em>, then yes -- this falls out of the uniqueness of mutable references.<br>
if the writing pointer is a raw pointer, then no.</p>



<a name="214341193"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214341193" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214341193">(Oct 23 2020 at 17:22)</a>:</h4>
<p>I feel fairly strongly that C/C++'s "object memory model" is way too complicated for its own good, and that the memory contents of an allocation should be "flat", i.e., just a list of "abstract bytes" (but those bytes can be <a href="https://www.ralfj.de/blog/2018/07/24/pointers-and-bytes.html">somewhat weird</a>). I reflected this in my notes on the <a href="https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/memory-interface.md">memory interface</a>.<br>
These objects make memory in C <em>extremely</em> complicated; the only precise description of it that I know is <a href="https://robbertkrebbers.nl/thesis.html">this PhD thesis</a>. (The standard itself is far from what I consider a precise description.) I do not think the complexity is justified. Programmers like to think of memory as being flat and consisting of bytes, I would like to diverge from that as little as absolutely necessary. Ergo, I would like to use the aliasing model and nothing else to satisfy any optimizations needs we have regarding aliasing within a single allocation. I think that is possible, and I think it is much easier than making memory a tree of abstract objects and defining how to reinterpet that tree as plain bytes when doing <code>char*</code> accesses.</p>



<a name="214360107"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214360107" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214360107">(Oct 23 2020 at 20:09)</a>:</h4>
<p>My argument would that a flat aliasing model isn't sufficient with UnsafeCell at the least, since an &amp;UnsafeCell&lt;T&gt;'s memory can overlap with a &amp;mut T (one of the reasons for UnsafeCell, and part of the safe api of RefCell&lt;T&gt;). Even if it doesn't require that, an object model should be a valid implementation of rust, as long as the as-if rule isn't violated. I don't build memory out of abstract objects, rather I "allocate" the objects into memory (or registers, or anywhere else either, as long as it doesn't violate the as-if rule), distinct objects can intersect in any way that one object totally exists within the allocation of another under certain circumstances. The most major issue was what I brought up here, and the resolution is one I can live with (it just limits how pointer invalidation interacts with attribute inference).</p>



<a name="214417313"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214417313" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214417313">(Oct 24 2020 at 09:17)</a>:</h4>
<blockquote>
<p>My argument would that a flat aliasing model isn't sufficient with UnsafeCell at the least</p>
</blockquote>
<p>I think Stacked Borrows is sufficient, and we even have proofs that it enables a bunch of powerful optimizations. :)</p>



<a name="214417362"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214417362" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214417362">(Oct 24 2020 at 09:18)</a>:</h4>
<blockquote>
<p>since an &amp;UnsafeCell&lt;T&gt;'s memory can overlap with a &amp;mut T </p>
</blockquote>
<p>no it cannot, <code>&amp;mut T</code> is still unique. that's what I said above. but it can overlap with a <code>*mut T</code>.</p>



<a name="214417425"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214417425" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214417425">(Oct 24 2020 at 09:20)</a>:</h4>
<blockquote>
<p>Even if it doesn't require that, an object model should be a valid implementation of rust,</p>
</blockquote>
<p>This is where we rather strongly disagree. The only way I know is to permit an object model in an implementation is to put one in the spec. And that would be a huge mistake I think.<br>
I am in favor of implementation divergence, but only insofar as it does not make the lives of Rust programmers harder. Imposing an object memory model on all Rust programmers just because some implementation wants to do something more C/C++-like would be a mistake. The point of Rust is to learn from the mistakes of C/C++, not to repeat them.</p>
<blockquote>
<p>as long as the as-if rule isn't violated</p>
</blockquote>
<p>I mean sure, if you can prove that your model refines a non-object-based Rust specification, then your model is a correct implementation of Rust. I just have not seen such an object model so far and I am skeptical for how useful it still could be -- it seems it would have to carry all the complexity of a "tree-like" memory without any of the benefits since every single memory access can "violate the object structure" arbitrarily.</p>



<a name="214417578"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214417578" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214417578">(Oct 24 2020 at 09:24)</a>:</h4>
<p>Regarding your original question, current Stacked Borrows actually goes even further than "leaking" things to <code>*mut T</code>: a <code>&amp;Option&lt;Cell&lt;T&gt;&gt;</code> permits mutating the data field even if the <code>Option</code> is <code>None</code> (see <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/236">this issue</a>). I am not very happy with this, but the alternative is to make the aliasing model itself perform memory accesses to figure out what the active variants of the involved enums are, and that makes me even more unhappy than the current situation.^^</p>



<a name="214426230"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214426230" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214426230">(Oct 24 2020 at 12:54)</a>:</h4>
<p>The only "problem" with UnsafeCell is that multiple &amp;UnsafeCell&lt;T&gt; can alias each other even though they actually allow write access (they can also alias &amp;T which doesn't allow write access)<br>
But nothing in rust allows aliasing a &amp;mut T, not even UnsafeCell</p>



<a name="214433019"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214433019" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214433019">(Oct 24 2020 at 15:20)</a>:</h4>
<blockquote>
<blockquote>
<p>since an &amp;UnsafeCell&lt;T&gt;'s memory can overlap with a &amp;mut T </p>
</blockquote>
<p>no it cannot, <code>&amp;mut T</code> is still unique. that's what I said above. but it can overlap with a <code>*mut T</code>.</p>
</blockquote>
<p>What I mean is that from a &amp;UnsafeCell&lt;T&gt;, you can get a &amp;mut T, which overlaps the same memory reach. This is a feature of RefCell and of Mutex. I didn't say it wasn't UB to get multiple &amp;mut Ts from a &amp;UnsafeCell&lt;T&gt;, but the mere fact you can seems, at least in my opinion, to violate the aliasing rules. (So therefore, UnsafeCell is magic under SB. Under the model I use, it's <em>less</em> magic, but it's still 50% magic because of how mutable, which is used in the implementation, interacts with pointer invalidation)</p>



<a name="214435030"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does%20UnsafeCell%3CT%3E%20leak%20mutability/near/214435030" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Does.20UnsafeCell.3CT.3E.20leak.20mutability.html#214435030">(Oct 24 2020 at 16:05)</a>:</h4>
<blockquote>
<p>from a &amp;UnsafeCell&lt;T&gt;, you can get a &amp;mut T</p>
</blockquote>
<p>Ah yes. that is indeed one of the key goals of <code>UnsafeCell</code>.<br>
And <code>UnsafeCell</code> is definitely magic, that's why it needs to be a lang item.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>